Using the Salesforce REST API from MCP tools

The Salesforce REST API is an HTTP interface that reads and writes Salesforce records, runs SOQL queries, and describes object metadata, using JSON request and response bodies. Your client authenticates with OAuth 2.0, sends a bearer token, and calls versioned paths under the instance URL that the login response returns. An MCP tool wraps those calls so an agent can query Salesforce without custom client code.

What the Salesforce REST API covers

The Salesforce REST API exposes org data and metadata over HTTP. It uses standard verbs, accepts JSON bodies, and returns JSON responses. The official reference at https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_what_is_rest_api.htm lists every resource family and explains how versioned paths work.

Most agent work touches three areas. Each area maps to a different group of endpoints.

• Query: run SOQL against objects and follow pagination links to read large result sets.
• Records: create, read, update, and delete individual sObjects by ID.
• Describe: read object and field metadata so the agent knows which fields exist before it writes.

Start with describe calls when the agent does not know the org layout. A describe response lists field names, types, and whether a field accepts writes. The agent then builds valid create and update payloads without guessing.

Authenticate before the first call

Salesforce expects OAuth 2.0 access tokens for most REST integrations. Create a connected app in the org, choose the flow that fits the use case, and request a token. The login response includes an access token and an instance URL. Send every later request to that instance URL, not to a generic login host.

Server-to-server agents often use the JWT bearer flow or the client credentials flow, where the org enables it. Interactive agents use the authorization code flow and keep a refresh token. Store the refresh token in a secrets manager. Do not place it in prompt text or log output.

Scope the connected app to the smallest set of permissions the agent needs. A narrow profile limits the damage if a token leaks.

Call the query and record endpoints

Send a GET request to the query path with a SOQL string in the q parameter. The response contains a records array and, when more rows exist, a nextRecordsUrl value. Follow that URL to fetch the next page until the response no longer includes it.

Create a record with a POST to the sObject path, such as the Account path, and send the field values as JSON. Update a record with PATCH on its ID path. Delete a record with DELETE on the same path. A successful create returns the new record ID, which the agent should store for later steps.

Keep SOQL selective. Query only the fields the agent uses, and filter on indexed fields where possible. Broad queries consume more of the org request budget and slow the agent down.

Give your agent Salesforce access through MCP tools

An MCP tool exposes each endpoint as a named function with a typed input schema. The agent chooses the function and fills in arguments. The gateway attaches the stored credentials, calls the Salesforce path, and returns the JSON body. The agent never handles the refresh token.

Search the APIbase catalog for Salesforce to see which endpoints are available and what each tool accepts. Connect an account from the connect page so the gateway holds the credentials. The published price range runs from 0 USD to 29.99 USD. The pricing page lists the current tiers.

This pattern suits agents that answer questions about pipeline, cases, or account health. The agent reads records through query tools and writes only through tools that the operator has approved.

Pagination and bulk work

Salesforce returns results in pages. A query that matches many rows returns the first page with a pointer to the next one. Your code must follow that pointer. Stopping after the first page silently drops records, and the agent may report incomplete answers as complete.

For bulk writes, group records into batches instead of sending one request per row. The composite and batch resources in the REST API reduce round trips. Check the official reference for the exact request shape and the batch size each resource accepts.

Record the count of records read and the count of records written on every run. A mismatch shows where a loop stopped early or a batch partly failed.

Limits, errors, and caveats

Request limits apply to every org. The limit depends on the edition and license, so check the usage figures in the org before you plan a large job. This guide does not quote a fixed number, because the figure changes with the org.

A 401 response usually means the access token expired. Refresh the token and retry once. If the error repeats, check the connected app scopes and whether the user still has an active license.

A 400 response that names a malformed SOQL query means the query needs a fix. Retrying the same string will fail again. Read the error message, correct the field name or the filter, and send the corrected query.

Writes are not safe to retry blindly. Before you retry a failed create, query for a record with the same unique field. A retry without that check can create duplicates.

Security practices for agent access

Treat the Salesforce org as production data, even during testing. Give the agent a sandbox org first, then move the working configuration to production after review.

• Scope the connected app and user profile to the fields and objects the agent needs.
• Keep refresh tokens in a secrets store, and rotate them when a team member leaves.
• Log request paths and status codes, but do not log record bodies that contain personal data.

Review field-level security as well. A profile can grant object access while hiding sensitive fields, and the agent sees only what the profile allows.

Live pricing — developer

Connect via MCP

$ curl -X POST https://apibase.pro/api/v1/tools/account.timeseries/call \
  -H "Content-Type: application/json" -d '{"params": {}}'

FAQ

What is the Salesforce REST API used for?

It reads, creates, updates, and deletes Salesforce records, runs SOQL queries, and reads object metadata over HTTP. Requests and responses use JSON.

How do I authenticate to the Salesforce REST API?

Create a connected app in the org, obtain an OAuth 2.0 access token through a flow that fits your setup, and send requests to the instance URL that the login response returns.

Can an AI agent call the Salesforce REST API?

Yes. An agent calls the endpoints through MCP tools that wrap each path with a typed schema. The tool holds the credentials, so the agent does not handle raw tokens.

Why does my Salesforce call return a 401 error?

The access token has usually expired. Refresh it and retry once. If the error repeats, check the connected app scopes and the user license.

Recommended next step

1. STEP 1/2 Connect your MCP client
2. STEP 2/2 Browse the full catalog

Related guides

• api layer
• usdc nv
• usdc cryptocurrency
• hugging face ai agents course

Written with AI assistance from APIbase's published documentation and public data; checked automatically against them. Corrections: https://apibase.pro/

Published: 2026-11-12Source: live apibase.pro catalog snapshot